mirivlad/bp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add anywhere csrf protection

Browse Source
This commit is contained in:
root
2026-01-12 18:31:04 +03:00
parent c55264cf42
commit 24ea8deeec
5 changed files with 102 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Views/macros/forms.twig
+2 -2
View File
@@ -1,7 +1,7 @@
{# app/Views/macros/forms.twig #}
{% macro form_open(action, attributes = '') %}
<form action="{{ action }}" method="post" {{ attributes|raw }}>
{# Выводим глобальную переменную csrf_token #}
{# Добавляем data-ajax="true" для автоматической CSRF защиты #}
<form action="{{ action }}" method="post" data-ajax="true" {{ attributes|raw }}>
{{ csrf_field()|raw }}
{% endmacro %}
app/Views/organizations/invitation_accept.twig
+2 -2
View File
@@ -59,8 +59,8 @@
{% endif %}
{# Форма принятия/отклонения #}
<form action="/invitation/accept/{{ token }}" method="POST">
<input type="hidden" name="<?= csrf_token() ?>" value="<?= csrf_hash() ?>">
<form action="/invitation/accept/{{ token }}" method="POST" data-ajax="true">
{{ csrf_field()|raw }}
<input type="hidden" name="action" value="accept">
<div class="d-flex gap-3">
app/Views/organizations/invitation_complete.twig
+2 -2
View File
@@ -47,8 +47,8 @@
{% endif %}
{# Форма регистрации #}
<form action="/invitation/complete/{{ token }}" method="POST">
<input type="hidden" name="<?= csrf_token() ?>" value="<?= csrf_hash() ?>">
<form action="/invitation/complete/{{ token }}" method="POST" data-ajax="true">
{{ csrf_field()|raw }}
<div class="mb-3">
<label for="completeName" class="form-label">Ваше имя</label>
app/Views/organizations/invite_modal.twig
+2 -2
View File
@@ -11,8 +11,8 @@
<button type="button" class="btn-close" data-bs-dismiss="modal"></button>
</div>
<div class="modal-body">
<form id="inviteUserForm" action="/organizations/users/{{ organization_id }}/invite" method="POST">
<input type="hidden" name="<?= csrf_token() ?>" value="<?= csrf_hash() ?>">
<form id="inviteUserForm" action="/organizations/users/{{ organization_id }}/invite" method="POST" data-ajax="true">
{{ csrf_field()|raw }}
<div class="mb-3">
<label for="inviteEmail" class="form-label">Email адрес</label>